library(RColorBrewer)
servs <- read.csv('servByDate.csv', head=T)
servs$dosday <- as.Date(servs$dosday)
dom<- c("201105" ,"201106", "201107", "201108", "201109", "201110","201111","201112",
        "201201", "201202","201203", "201204","201205","201206", "201207" ,"201208" ,"201209",
        "201210", "201211","201212", "201301","201302", "201303", "201304", "201305", "201306",
        "201307", "201308", "201309", "201310")
servs$ym <- format(servs$dosday,'%Y%m')
servs$ym <- factor(servs$ym, levels=dom)
catday <- table(servs$cat,servs$ym)

#fig 1
barplot(catday, col=brewer.pal(6,"Dark2"),angle=c(0,30,60,90,120,150),density=15,border=T,ylab='# of DDoS attacks reported',las=3)
legend('topleft',legend=levels(servs$cat),col=brewer.pal(6,"Dark2"),angle=c(0,30,60,90,120,150),density=15,text.col=brewer.pal(6,"Dark2"),fill=brewer.pal(6,"Dark2"),border=brewer.pal(6,"Dark2"))

#fig 2a
barplot(100*sort(prop.table(table(servs$cat)),decreasing=T),col=c("#1B9E77","#E6AB02","#E7298A","#7570B3","#66A61E","#D95F02"),angle=c(0,150,90,60,120,30),density=10,border=T,ylab='% of DDoS attacks targeting service category',cex.lab=2,cex.axis=1.5,names.arg=c("currency\nexchange","pool","gambling","financial","other","eWallet"))

#fig 2b
cdfserv<-ecdf(table(servs$service))
plot(x=c(0,environment(cdfserv)$x),y=c(0,environment(cdfserv)$y),lwd=3,type='s',ylab='Fraction of targets attacked at least x times',xlim=c(1,30),xlab='x times a service is DDoSed',cex.lab=2,cex.axis=1.5)


allserv <- read.csv('btcservices.csv')
allserv <- allserv[allserv$ip != '0.0.0.0',]
allserv$ip <- factor(allserv$ip)
allserv$url <- factor(allserv$url)
allserv$cf <- allserv$cf=="True"
allserv$ec2 <- allserv$ec2=="True"
allserv$incapsula <- allserv$incapsula == "True"
allserv$DDoS <- allserv$DDoS!="False"
allserv$antiDDos <- allserv$cf | allserv$ec2 | allserv$incapsula
servList=c('Material / Physical Products','Internet &amp; Mobile services', 'Online products','Professional services','Currency exchanges','Travel / Tourism / Leisure','Commerce and community','Getting started','Financial','Pool','Bitcoin eWallets','Bitcoin payment systems')
cats <- factor(allserv$cat1, levels=servList, ordered=T, labels=servList)


#Table 2 -- use antiddos ?
adserv <- table(cats, allserv$antiDDos)
colnames(adserv) <- c("Other Hosting","EC2 or CloudFlare or Incapsula")
adservdf<-data.frame(cbind(adserv[,1],adserv[,2]))
names(adservdf)<-c('otherhost','antiddos')
adservdf$pctanti<-100*adservdf$antiddos/(adservdf$antiddos+adservdf$otherhost)
adservdf$numcat<-adservdf$antiddos+adservdf$otherhost
adservdf<-rbind(adservdf,Average=c(NA,NA,mean(adservdf$pctanti),NA))

#Table 2 -- suffer ddos ?
ddserv <- table(cats, allserv$DDoS)
ddservdf<-data.frame(cbind(ddserv[,1],ddserv[,2]))
names(ddservdf)<-c('notddos','ddos')
ddservdf$pctddos<-100*ddservdf$ddos/(ddservdf$ddos+ddservdf$notddos)
ddservdf$numcat<-ddservdf$ddos+ddservdf$notddos
ddservdf<-rbind(ddservdf,Average=c(NA,NA,mean(ddservdf$pctddos),NA))

#Table 2 -- the number of services running anti-ddos and have been ddosed
table(allserv$cat1[allserv$DDoS==T], allserv$antiDDos[allserv$DDoS==T])
#Table 2 -- number of services running anti-ddos but not ddosed
table(allserv$cat1[allserv$DDoS==F], allserv$antiDDos[allserv$DDoS==F])
#Table2 -- number of services ddosed but not running anti-ddos
table(allserv$cat1[allserv$DDoS==T], allserv$antiDDos[allserv$DDoS==T])


#Table 3
table(allserv$DDoS,allserv$antiDDos)
chisq.test(cbind(c(178,1012),c(25,21)))

rates <- read.csv("goxRates.csv", head=T)
rates$Timestamp <- as.Date(rates$Timestamp)
pools <- read.csv("poolshare.csv",head=T)
pools$date <- as.Date(pools$date)
bigPools <- c('50BTC','BTC-Guild','Deepbit','Slush')
pools$big <- pools$pool %in% bigPools
poolcols <- c("chartreuse3","blue","cyan3","gold","darkmagenta","deeppink")

#Fig 3
plot(pools[pools$pool=="Slush",]$date,pools[pools$pool=="Slush",]$marketShare, col = poolcols[1], xlab = "", ylab = "Hashrate share", type='l',main = "Slush's Pool", ylim=c(0,0.42),xlim=c(min(servs$dosday),max(servs$dosday)),cex.lab=1.6,cex.axis=1.4)
abline(v=servs[servs$service=='slush',]$dosday,col=poolcols[1], lty="dashed")

plot(pools[pools$pool=="BTC-Guild",]$date, pools[pools$pool=="BTC-Guild",]$marketShare, col = poolcols[2], xlab = "", ylab = "Hashrate share", type='l',main = "BTC Guild", ylim=c(0,0.42),xlim=c(min(servs$dosday),max(servs$dosday)),cex.lab=1.6,cex.axis=1.4)
abline(v=servs[servs$service=="btcguild",]$dosday ,col=poolcols[2], lty="dashed")

plot(pools[pools$pool=="EclipseMC",]$date, pools[pools$pool=="EclipseMC",]$marketShare, col=poolcols[3], xlab = "", ylab = "Hashrate share", type='l',main = "Eclipse MC", ylim=c(0,0.42),xlim=c(min(servs$dosday),max(servs$dosday)),cex.lab=1.6,cex.axis=1.4)
abline(v=servs[servs$service=="eclipse",]$dosday ,col=poolcols[3], lty="dashed")

plot(pools[pools$pool=="Deepbit",]$date, pools[pools$pool=="Deepbit",]$marketShare, col = poolcols[4], xlab = "", ylab = "Hashrate share", type='l',main = "DeepBit", ylim=c(0,0.42),xlim=c(min(servs$dosday),max(servs$dosday)),cex.lab=1.6,cex.axis=1.4)
abline(v=servs[servs$service=="deepbit",]$dosday ,col=poolcols[4], lty="dashed")

plot(pools[pools$pool=="50BTC",]$date, pools[pools$pool=="50BTC",]$marketShare, col = poolcols[5], xlab = "", ylab = "Hashrate share", type='l',main = "50BTC", ylim=c(0,0.42),xlim=c(min(servs$dosday),max(servs$dosday)),cex.lab=1.6,cex.axis=1.4)

plot(pools[pools$pool=="Eligius",]$date, pools[pools$pool=="Eligius",]$marketShare, col = poolcols[6], xlab = "", ylab = "Hashrate share", type='l',main = "Eligius", ylim=c(0,0.42),xlim=c(min(servs$dosday),max(servs$dosday)),cex.lab=1.6,cex.axis=1.4)
abline(v=servs[servs$service=="eligius",]$dosday ,col=poolcols[6], lty="dashed")



#Fig 4 top
plot(rates$Timestamp, rates$Volume..Currency./1000000, type='l', ylab="Daily Trade Volume (Mil. USD)", xlab="")
abline(v=servs$dosday[servs$service=="mtgox"], col="chartreuse3",lty='dashed')

#Fig 4 bottom
plot(rates$Timestamp, rates$Weighted.Price, type='l',xlab="Date", ylab="Exchange Rate (BTC - USD)")
abline(v=servs$dosday[servs$service=="mtgox"], col="chartreuse3", lty="dashed")

dosdates <- servs[servs$service=='mtgox',]$dosday
dosmgf<-servs[servs$service=='mtgox',]
dosStartDates <- dosdates - 7
dosEndDates <- dosdates + 7
dosWeeks <- data.frame(dosStartDates, dosEndDates)
dosmgf$btcvol.before<-sapply(dosmgf$dosday, function (x) sum(rates$Volume..BTC[rates$Timestamp>=x-7&rates$Timestamp<x]))
dosmgf$btcvol.after<-sapply(dosmgf$dosday, function (x) sum(rates$Volume..BTC[rates$Timestamp>x&rates$Timestamp<=x+7]))
dosmgf$btcvol.delta<-dosmgf$btcvol.after/dosmgf$btcvol.before*100-100
posx <- dosmgf[dosmgf$btcvol.delta>0, ]$dosday
posy <- dosmgf[dosmgf$btcvol.delta>0, ]$btcvol.delta
negx <- dosmgf[dosmgf$btcvol.delta<0, ]$dosday
negy <- dosmgf[dosmgf$btcvol.delta<0, ]$btcvol.delta

#Table 5
length(posx) # # of Attacks
length(negx) 
length(posx)/(length(posx)+length(negx)) # % Attacks
length(negx)/(length(posx)+length(negx))
median(posy) # % Change <-- huge variance so we used median over mean
median(negy)

#Fig 5
plot(x=posx,y=posy,type='h',ylim=c(min(negy), max(posy)), col = 'darkgreen',ylab='Percent change in BTC trade volume', xlab='Date', lwd=2, lty=2)
points(x=negx,y=negy,type='h',col='red', lwd=2)
abline(h=0)
legend("top", col=c('darkgreen','red'), legend = c('Increased trade volume','Decreased trade volume'), lty=c(2,1), lwd=2)
